release-artifacts.yml

name: Release Artifacts

on:
  workflow_dispatch:
    inputs:
      windows_signed:
        description: Build signed Windows portable package through the release-signing environment
        required: false
        default: false
        type: boolean
      macos_signed:
        description: Build signed and notarized macOS app packages through the release-signing environment
        required: false
        default: false
        type: boolean
      macos_x64:
        description: Also build the Intel x64 macOS app package
        required: false
        default: false
        type: boolean
      publish_itch:
        description: Publish signed desktop artifacts and the HTML5 build to itch.io
        required: false
        default: false
        type: boolean
  push:
    tags:
      - "v*.*.*"

permissions:
  contents: read

env:
  TELEMETRY_PROVIDER: ${{ vars.TELEMETRY_PROVIDER }}
  TELEMETRY_POSTHOG_PROJECT_KEY: ${{ secrets.TELEMETRY_POSTHOG_PROJECT_KEY }}
  TELEMETRY_POSTHOG_HOST: ${{ vars.TELEMETRY_POSTHOG_HOST }}
  TELEMETRY_ENABLED: ${{ vars.TELEMETRY_ENABLED }}
  TELEMETRY_BUILD_CHANNEL: ${{ vars.TELEMETRY_BUILD_CHANNEL }}

jobs:
  checks:
    name: Release gates
    runs-on: ubuntu-24.04
    timeout-minutes: 45

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: npm

      - name: Validate release tag
        if: ${{ github.ref_type == 'tag' }}
        run: |
          node -e 'const pkg = require("./package.json"); const tag = process.env.GITHUB_REF_NAME; const expected = "v" + pkg.version; if (tag !== expected) { console.error(`Release tag ${tag} does not match package version ${pkg.version}. Expected ${expected}.`); process.exit(1); }'

      - name: Install dependencies
        run: npm ci

      - name: Check licenses
        run: npm run license:check

      - name: Typecheck
        run: npm run typecheck

      - name: Test
        run: npm test

      - name: Lint
        run: npm run lint

  web:
    name: itch.io web release package
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    needs: checks

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Build itch.io web package
        run: npm run web:package:itch
        env:
          TELEMETRY_DISTRIBUTION: web_itch

      - name: Upload itch.io web package
        uses: actions/upload-artifact@v7
        with:
          name: pixelaid-web-itch
          path: artifacts/web/*web-itch.zip
          archive: false
          if-no-files-found: error
          retention-days: 30

  windows:
    name: Windows portable release package
    runs-on: windows-2022
    timeout-minutes: 60
    needs: checks
    if: ${{ github.ref_type != 'tag' && github.event.inputs.windows_signed != 'true' }}

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: npm

      - name: Setup Rust
        run: |
          rustup toolchain install stable --profile minimal
          rustup default stable

      - name: Show tool versions
        run: |
          node --version
          npm --version
          rustc --version
          cargo --version

      - name: Install dependencies
        run: npm ci

      - name: Build unsigned Windows portable package
        run: npm run desktop:package:windows
        env:
          TELEMETRY_DISTRIBUTION: desktop_windows_portable

      - name: Verify Windows package
        run: |
          $zip = Get-ChildItem artifacts/desktop/*windows*-portable.zip | Select-Object -First 1
          if (-not $zip) {
            throw "No Windows portable zip found."
          }

          tar -tf $zip.FullName

          $extractDir = Join-Path $env:RUNNER_TEMP "pixelaid-windows"
          if (Test-Path $extractDir) {
            Remove-Item -Recurse -Force $extractDir
          }
          New-Item -ItemType Directory -Path $extractDir | Out-Null
          tar -xf $zip.FullName -C $extractDir

          node apps/desktop/scripts/verify-desktop-package.mjs windows $extractDir

      - name: Upload Windows portable package
        uses: actions/upload-artifact@v7
        with:
          name: pixelaid-windows-portable
          path: artifacts/desktop/*windows*-portable.zip
          archive: false
          if-no-files-found: error
          retention-days: 30

  windows-signed:
    name: Windows signed portable release package
    runs-on: windows-2022
    timeout-minutes: 75
    needs: checks
    if: ${{ github.ref_type == 'tag' || github.event.inputs.windows_signed == 'true' }}
    environment: release-signing
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: npm

      - name: Setup .NET
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: 8.0.x

      - name: Setup Rust
        run: |
          rustup toolchain install stable --profile minimal
          rustup default stable

      - name: Azure login
        uses: azure/login@v3
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Restore Microsoft Artifact Signing client
        shell: pwsh
        run: |
          $projectDir = Join-Path $env:RUNNER_TEMP "artifact-signing-client"
          New-Item -ItemType Directory -Path $projectDir -Force | Out-Null
          dotnet new classlib --framework net8.0 --output $projectDir
          $project = Join-Path $projectDir "artifact-signing-client.csproj"
          dotnet add $project package Microsoft.ArtifactSigning.Client

      - name: Show tool versions
        run: |
          node --version
          npm --version
          dotnet --version
          rustc --version
          cargo --version

      - name: Install dependencies
        run: npm ci

      - name: Build signed Windows portable package
        run: npm run desktop:package:windows:signed
        env:
          TELEMETRY_DISTRIBUTION: desktop_windows_portable
          WINDOWS_SIGNING_ENDPOINT: ${{ secrets.WINDOWS_SIGNING_ENDPOINT }}
          WINDOWS_SIGNING_ACCOUNT_NAME: ${{ secrets.WINDOWS_SIGNING_ACCOUNT_NAME }}
          WINDOWS_SIGNING_CERTIFICATE_PROFILE_NAME: ${{ secrets.WINDOWS_SIGNING_CERTIFICATE_PROFILE_NAME }}

      - name: Verify signed Windows package
        run: |
          $zip = Get-ChildItem artifacts/desktop/*windows*-signed-portable.zip | Select-Object -First 1
          if (-not $zip) {
            throw "No signed Windows portable zip found."
          }

          tar -tf $zip.FullName

          $extractDir = Join-Path $env:RUNNER_TEMP "pixelaid-windows-signed"
          if (Test-Path $extractDir) {
            Remove-Item -Recurse -Force $extractDir
          }
          New-Item -ItemType Directory -Path $extractDir | Out-Null
          tar -xf $zip.FullName -C $extractDir

          node apps/desktop/scripts/verify-desktop-package.mjs windows $extractDir --signed

      - name: Upload signed Windows portable package
        uses: actions/upload-artifact@v7
        with:
          name: pixelaid-windows-signed-portable
          path: artifacts/desktop/*windows*-signed-portable.zip
          archive: false
          if-no-files-found: error
          retention-days: 30

  macos:
    name: macOS app release package (${{ matrix.arch }})
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 60
    needs: checks
    if: ${{ github.ref_type != 'tag' && github.event.inputs.macos_signed != 'true' }}
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON((github.ref_type == 'tag' || github.event.inputs.macos_x64 == 'true') && '[{"runner":"macos-15","arch":"arm64"},{"runner":"macos-15-intel","arch":"x64"}]' || '[{"runner":"macos-15","arch":"arm64"}]') }}

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: npm

      - name: Setup Rust
        run: |
          rustup toolchain install stable --profile minimal
          rustup default stable

      - name: Show tool versions
        run: |
          node --version
          npm --version
          rustc --version
          cargo --version
          uname -m

      - name: Install dependencies
        run: npm ci

      - name: Build unsigned macOS app package
        run: npm run desktop:package:macos -- --arch ${{ matrix.arch }}
        env:
          TELEMETRY_DISTRIBUTION: desktop_macos_app

      - name: Verify macOS package
        run: |
          zip="$(find artifacts/desktop -name '*macos*-${{ matrix.arch }}-app.zip' -print -quit)"
          if [ -z "$zip" ]; then
            echo "No macOS ${{ matrix.arch }} app zip found." >&2
            exit 1
          fi

          unzip -l "$zip"

          extract_dir="$RUNNER_TEMP/pixelaid-macos-${{ matrix.arch }}"
          rm -rf "$extract_dir"
          mkdir -p "$extract_dir"
          ditto -x -k "$zip" "$extract_dir"

          node apps/desktop/scripts/verify-desktop-package.mjs macos "$extract_dir" "${{ matrix.arch }}"

      - name: Upload macOS app package
        uses: actions/upload-artifact@v7
        with:
          name: pixelaid-macos-${{ matrix.arch }}-app
          path: artifacts/desktop/*macos*-${{ matrix.arch }}-app.zip
          archive: false
          if-no-files-found: error
          retention-days: 30

  macos-signed:
    name: macOS signed app release package (${{ matrix.arch }})
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 90
    needs: checks
    if: ${{ github.ref_type == 'tag' || github.event.inputs.macos_signed == 'true' }}
    environment: release-signing
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON((github.ref_type == 'tag' || github.event.inputs.macos_x64 == 'true') && '[{"runner":"macos-15","arch":"arm64"},{"runner":"macos-15-intel","arch":"x64"}]' || '[{"runner":"macos-15","arch":"arm64"}]') }}

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 24
          cache: npm

      - name: Setup Rust
        run: |
          rustup toolchain install stable --profile minimal
          rustup default stable

      - name: Show tool versions
        run: |
          node --version
          npm --version
          rustc --version
          cargo --version
          uname -m

      - name: Install dependencies
        run: npm ci

      - name: Import Apple signing assets
        shell: bash
        env:
          MACOS_CERTIFICATE_P12_BASE64: ${{ secrets.MACOS_CERTIFICATE_P12_BASE64 }}
          MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
          MACOS_KEYCHAIN_PASSWORD: ${{ secrets.MACOS_KEYCHAIN_PASSWORD }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_KEY_P8_BASE64: ${{ secrets.APPLE_API_KEY_P8_BASE64 }}
        run: |
          for required in MACOS_CERTIFICATE_P12_BASE64 MACOS_CERTIFICATE_PASSWORD MACOS_KEYCHAIN_PASSWORD APPLE_API_KEY APPLE_API_KEY_P8_BASE64; do
            if [ -z "${!required}" ]; then
              echo "$required is required for signed macOS release artifacts." >&2
              exit 1
            fi
          done

          certificate_path="$RUNNER_TEMP/pixelaid-certificate.p12"
          api_key_dir="$RUNNER_TEMP/appstoreconnect/private_keys"
          api_key_path="$api_key_dir/AuthKey_${APPLE_API_KEY}.p8"
          keychain_path="$RUNNER_TEMP/pixelaid-signing.keychain-db"

          mkdir -p "$api_key_dir"
          printf '%s' "$MACOS_CERTIFICATE_P12_BASE64" | base64 -D > "$certificate_path"
          printf '%s' "$APPLE_API_KEY_P8_BASE64" | base64 -D > "$api_key_path"

          security create-keychain -p "$MACOS_KEYCHAIN_PASSWORD" "$keychain_path"
          security set-keychain-settings -lut 21600 "$keychain_path"
          security unlock-keychain -p "$MACOS_KEYCHAIN_PASSWORD" "$keychain_path"
          security import "$certificate_path" -P "$MACOS_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k "$keychain_path"
          security list-keychains -d user -s "$keychain_path" $(security list-keychains -d user | sed 's/"//g')
          security default-keychain -s "$keychain_path"
          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_KEYCHAIN_PASSWORD" "$keychain_path"

          echo "APPLE_API_KEY_PATH=$api_key_path" >> "$GITHUB_ENV"
          echo "MACOS_SIGNING_KEYCHAIN=$keychain_path" >> "$GITHUB_ENV"

      - name: Build signed macOS app package
        run: npm run desktop:package:macos:signed -- --arch ${{ matrix.arch }}
        env:
          TELEMETRY_DISTRIBUTION: desktop_macos_app
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}

      - name: Verify signed macOS package
        run: |
          zip="$(find artifacts/desktop -name '*macos*-${{ matrix.arch }}-signed-app.zip' -print -quit)"
          if [ -z "$zip" ]; then
            echo "No signed macOS ${{ matrix.arch }} app zip found." >&2
            exit 1
          fi

          unzip -l "$zip"

          extract_dir="$RUNNER_TEMP/pixelaid-macos-${{ matrix.arch }}-signed"
          rm -rf "$extract_dir"
          mkdir -p "$extract_dir"
          ditto -x -k "$zip" "$extract_dir"

          node apps/desktop/scripts/verify-desktop-package.mjs macos "$extract_dir" "${{ matrix.arch }}" --signed

      - name: Upload signed macOS app package
        uses: actions/upload-artifact@v7
        with:
          name: pixelaid-macos-${{ matrix.arch }}-signed-app
          path: artifacts/desktop/*macos*-${{ matrix.arch }}-signed-app.zip
          archive: false
          if-no-files-found: error
          retention-days: 30

      - name: Cleanup Apple signing assets
        if: ${{ always() }}
        run: |
          keychain_path="${MACOS_SIGNING_KEYCHAIN:-$RUNNER_TEMP/pixelaid-signing.keychain-db}"
          if [ -f "$keychain_path" ]; then
            security delete-keychain "$keychain_path" || true
          fi
          rm -f "$RUNNER_TEMP/pixelaid-certificate.p12"
          rm -rf "$RUNNER_TEMP/appstoreconnect"

  publish-itch:
    name: Publish itch.io channels
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    needs:
      - web
      - windows
      - windows-signed
      - macos
      - macos-signed
    if: ${{ always() && (github.ref_type == 'tag' || github.event.inputs.publish_itch == 'true') }}
    environment: release-publishing

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Validate publish inputs
        env:
          NEEDS_JSON: ${{ toJSON(needs) }}
          RELEASE_TAG: ${{ github.ref_type == 'tag' }}
          WINDOWS_SIGNED: ${{ github.event.inputs.windows_signed }}
          MACOS_SIGNED: ${{ github.event.inputs.macos_signed }}
          BUTLER_API_KEY: ${{ secrets.BUTLER_API_KEY }}
          ITCH_TARGET: ${{ vars.ITCH_TARGET }}
        run: |
          if [ "$RELEASE_TAG" != "true" ] && { [ "$WINDOWS_SIGNED" != "true" ] || [ "$MACOS_SIGNED" != "true" ]; }; then
            echo "Itch publishing requires windows_signed and macos_signed." >&2
            exit 1
          fi
          if [ -z "$BUTLER_API_KEY" ]; then
            echo "BUTLER_API_KEY is required for itch.io publishing." >&2
            exit 1
          fi
          if [ -z "$ITCH_TARGET" ]; then
            echo "ITCH_TARGET is required for itch.io publishing." >&2
            exit 1
          fi

          node <<'NODE'
          const needs = JSON.parse(process.env.NEEDS_JSON);
          const required = {
            web: "itch.io web package",
            "windows-signed": "signed Windows package",
            "macos-signed": "signed macOS package",
          };
          const failed = Object.entries(required)
            .filter(([id]) => needs[id]?.result !== "success")
            .map(([id, label]) => `${label}: ${needs[id]?.result ?? "missing"}`);
          if (failed.length > 0) {
            console.error(`Cannot publish itch.io artifacts because required jobs did not succeed: ${failed.join(", ")}`);
            process.exit(1);
          }
          NODE

      - name: Download release artifacts
        uses: actions/download-artifact@v8
        with:
          path: release-artifacts
          skip-decompress: true

      - name: Install butler
        run: |
          curl -L -o "$RUNNER_TEMP/butler.zip" https://broth.itch.zone/butler/linux-amd64/LATEST/archive/default
          unzip -q "$RUNNER_TEMP/butler.zip" -d "$RUNNER_TEMP/butler"
          chmod +x "$RUNNER_TEMP/butler/butler"
          echo "$RUNNER_TEMP/butler" >> "$GITHUB_PATH"
          "$RUNNER_TEMP/butler/butler" version

      - name: Publish itch.io channels
        env:
          BUTLER_API_KEY: ${{ secrets.BUTLER_API_KEY }}
          ITCH_TARGET: ${{ vars.ITCH_TARGET }}
          PUBLISH_MACOS_X64: ${{ github.ref_type == 'tag' || github.event.inputs.macos_x64 == 'true' }}
        run: bash scripts/publish-itch-artifacts.sh